WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
Digits: WordPress Mobile Number Signup and Login <= 9.1.0.5 - Authenticated (Subscriber+) Privilege Escalation via 'digits_reg_userrole' Parameter
8.8
CVE-2026-13741
Jul 15, 2026
Researcher: h0xilo
Loco Translate <= 2.8.5 - Cross-Site Request Forgery to Remote Code Execution via 'template' Parameter
8.8
CVE-2026-15005
Jul 15, 2026
Researcher: mikemyers
WPFunnels <= 3.12.8 - Authenticated (Funnel Manager+) Privilege Escalation via 'group_id' Path Parameter
8.8
CVE-2026-15103
Jul 15, 2026
Researcher: PRISM
WP Bulk Delete <= 1.4.2 - Authenticated (Administrator+) SQL Injection via 'delete_user_roles' Parameter
4.9
CVE-2026-15727
Jul 15, 2026
Researcher: PRISM
SysBasics Customize My Account for WooCommerce <= 4.4.14 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'row_type' Parameter
4.4
CVE-2026-15324
Jul 15, 2026
Researcher: PRISM
wpForo Forum <= 3.1.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'location' Profile Field
6.4
CVE-2026-15021
Jul 15, 2026
Researcher: valent1
WPBot <= 8.5.6 - Missing Authorization to Unauthenticated Arbitrary Chat Session Deletion via 'userid' Parameter
5.3
CVE-2026-15106
Jul 15, 2026
Researcher: PRISM
WPBot <= 8.5.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary RAG Document Re-Sync via ajax_rag_manual_sync() Function
4.3
CVE-2026-15610
Jul 15, 2026
Researcher: PRISM
Tickera <= 3.6.0.0 - Authenticated (Staff+) SQL Injection via 's' Parameter
6.5
CVE-2026-13754
Jul 15, 2026
Researcher: PRISM
Uncanny Automator <= 7.3.1.4 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via Forminator Submitted-Field Token
8.1
CVE-2026-15008
Jul 15, 2026
Researcher: daroo
WP TripAdvisor Review Slider <= 14.6 - Authenticated (Administrator+) SQL Injection via 'filtersource' Parameter
4.9
CVE-2026-15651
Jul 15, 2026
Researcher: PRISM
WP Delicious <= 1.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'steps' Block Attribute
6.4
CVE-2026-15099
Jul 15, 2026
Researcher: PRISM
Tutor LMS <= 4.0.0 - Authenticated (Subscriber+) SQL Injection via Stored Quiz Answer Array
6.5
CVE-2026-15022
Jul 15, 2026
Researcher: Supakiad S. (m3ez)
Tickera <= 3.6.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'price_wrapper' Shortcode Attribute
6.4
CVE-2026-13755
Jul 15, 2026
Researcher: PRISM
The Cache Purger <= 2.3.20 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Log Deletion via 'the_log_purge' Parameter
4.3
CVE-2026-15350
Jul 15, 2026
Researcher: PRISM
Quiz and Survey Master (QSM) <= 11.2.0 - Authenticated (Custom+) SQL Injection via 'pages' Parameter
6.5
CVE-2026-13767
Jul 15, 2026
Researcher: PRISM
Breakdance <= 2.7.1 - Unauthenticated Stored Cross-Site Scripting via Webhook Action Details
7.2
CVE-2026-7543
Jul 15, 2026
Researcher: h0xilo
SEO Booster <= 7.3.1 - Authenticated (Administrator+) SQL Injection via 'sort_field' Parameter
4.9
CVE-2026-15458
Jul 15, 2026
Researcher: PRISM
SEO Booster <= 7.3.1 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
4.9
CVE-2026-15445
Jul 15, 2026
Researcher: PRISM
RPB Chessboard <= 8.1.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content
7.2
CVE-2026-13042
Jul 15, 2026
Researcher: theviper17y
Title CVE ID CVSS Researchers Date
Digits: WordPress Mobile Number Signup and Login <= 9.1.0.5 - Authenticated (Subscriber+) Privilege Escalation via 'digits_reg_userrole' Parameter CVE-2026-13741 8.8 h0xilo July 15, 2026
Loco Translate <= 2.8.5 - Cross-Site Request Forgery to Remote Code Execution via 'template' Parameter CVE-2026-15005 8.8 mikemyers July 15, 2026
WPFunnels <= 3.12.8 - Authenticated (Funnel Manager+) Privilege Escalation via 'group_id' Path Parameter CVE-2026-15103 8.8 PRISM July 15, 2026
WP Bulk Delete <= 1.4.2 - Authenticated (Administrator+) SQL Injection via 'delete_user_roles' Parameter CVE-2026-15727 4.9 PRISM July 15, 2026
SysBasics Customize My Account for WooCommerce <= 4.4.14 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'row_type' Parameter CVE-2026-15324 4.4 PRISM July 15, 2026
wpForo Forum <= 3.1.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'location' Profile Field CVE-2026-15021 6.4 valent1 July 15, 2026
WPBot <= 8.5.6 - Missing Authorization to Unauthenticated Arbitrary Chat Session Deletion via 'userid' Parameter CVE-2026-15106 5.3 PRISM July 15, 2026
WPBot <= 8.5.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary RAG Document Re-Sync via ajax_rag_manual_sync() Function CVE-2026-15610 4.3 PRISM July 15, 2026
Tickera <= 3.6.0.0 - Authenticated (Staff+) SQL Injection via 's' Parameter CVE-2026-13754 6.5 PRISM July 15, 2026
Uncanny Automator <= 7.3.1.4 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via Forminator Submitted-Field Token CVE-2026-15008 8.1 daroo July 15, 2026
WP TripAdvisor Review Slider <= 14.6 - Authenticated (Administrator+) SQL Injection via 'filtersource' Parameter CVE-2026-15651 4.9 PRISM July 15, 2026
WP Delicious <= 1.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'steps' Block Attribute CVE-2026-15099 6.4 PRISM July 15, 2026
Tutor LMS <= 4.0.0 - Authenticated (Subscriber+) SQL Injection via Stored Quiz Answer Array CVE-2026-15022 6.5 Supakiad S. (m3ez) July 15, 2026
Tickera <= 3.6.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'price_wrapper' Shortcode Attribute CVE-2026-13755 6.4 PRISM July 15, 2026
The Cache Purger <= 2.3.20 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Log Deletion via 'the_log_purge' Parameter CVE-2026-15350 4.3 PRISM July 15, 2026
Quiz and Survey Master (QSM) <= 11.2.0 - Authenticated (Custom+) SQL Injection via 'pages' Parameter CVE-2026-13767 6.5 PRISM July 15, 2026
Breakdance <= 2.7.1 - Unauthenticated Stored Cross-Site Scripting via Webhook Action Details CVE-2026-7543 7.2 h0xilo July 15, 2026
SEO Booster <= 7.3.1 - Authenticated (Administrator+) SQL Injection via 'sort_field' Parameter CVE-2026-15458 4.9 PRISM July 15, 2026
SEO Booster <= 7.3.1 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter CVE-2026-15445 4.9 PRISM July 15, 2026
RPB Chessboard <= 8.1.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content CVE-2026-13042 7.2 theviper17y July 15, 2026
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Jun 16, 2026
Vulns
1 PRISM 72
2 daroo 48
3 João Pedro S Alcântara (Kinorth) 44
4 Ananda Dhakal 36
5 Nguyen Ba Khanh 25
6 dodoh4t 18
7 Chloe Chamberland 16
8 Bonds 15
9 Nabil Irawan 15
10 dutafi 14
11 Legion Hunter 13
12 ParkHyunWoo 12
13 Nguyen Dinh Hai (HaiND) 12
14 Muhammad Yudha - DJ 11
15 Athiwat Tiprasaharn (Jitlada) 10
16 Jakub Herman 10
17 zaim 9
18 VanTastic 9
19 endy 8
20 Osvaldo Noe Gonzalez Del Rio (Os) 7

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation